首个兼顾网页与AI安全的对话式训练数据集，助力生成更安全代码。
SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models
- 构建2185个对话样例，覆盖网页与AI安全两大领域
- 93.8分高质量评分，含攻击演示与深度防御建议
- 适合安全编码助手、模型训练者及开发团队使用
AI编程助手在45%的安全相关场景中生成有漏洞的代码。现有公开数据集无法同时提供传统网页安全和人工智能/机器学习特有防护的指令微调格式。本文提出SecureCode，一个生产级多轮安全训练数据集，共包含2,185个例子：网页安全部分1,435例，覆盖OWASP Top 10 2021中的11种语言和9个框架，全部基于已记录的CVE和安全事件；AI/ML安全部分750例，涵盖所有10类OWASP LLM Top 10 2025，涉及40多个框架（如LangChain、OpenAI、Hugging Face）。每条数据采用四轮对话结构：功能请求—漏洞与安全实现+攻击演示—深入探查—纵深防御操作指南。质量保障通过自动化校验、七种专业AI视角的多智能体评审（超10,500次评估）及八阶段修复流程完成，AI/ML部分平均质量得分达93.8/100（σ=0.93）。每个例子均提供SIEM集成策略、基础设施加固建议及使用生产框架的测试方法。数据集已发布于Hugging Face，支持按领域加载（web/aiml/default），并附带8个经微调的开源模型（3B–20B参数，QLoRA）和包含四个安全指标的评估框架。据我们所知，SecureCode是首个将OWASP Top 10 2021网页覆盖与OWASP LLM Top 10 2025 AI/ML覆盖统一于可直接用于指令微调的对话格式中的公开数据集。
原文摘要 · Abstract (English)
AI coding assistants produce vulnerable code in 45\% of security-relevant scenarios~\cite{veracode2025}, yet no public training dataset teaches both traditional web security and AI/ML-specific defenses in a format suitable for instruction tuning. We present SecureCode, a production-grade dataset of 2,185 multi-turn security training examples spanning two domains: web application security (1,435 examples covering the OWASP Top 10 2021 across 11 languages and 9 frameworks, 100\% grounded in documented CVEs and security incidents) and AI/ML security (750 examples covering all 10 OWASP LLM Top 10 2025 categories across more than 40 frameworks, including LangChain, OpenAI, and Hugging Face). Every example follows a 4-turn conversational structure -- feature request; vulnerable and secure implementations with attack demonstrations; advanced probing; and defense-in-depth operational guidance -- designed for direct use in instruction tuning pipelines. Quality assurance combines automated structural validation with multi-agent review from seven specialist AI perspectives (more than 10{,}500 assessments) and an 8-phase remediation pipeline, producing a rubric-calibrated mean quality score of 93.8/100 ($σ= 0.93$) for the AI/ML component. Each example provides SIEM integration strategies, infrastructure hardening recommendations, and testing approaches using production frameworks. We release the unified dataset on Hugging Face with domain-specific loading configurations (web, aiml, default), alongside eight fine-tuned open-source models (3B--20B parameters, QLoRA), and an evaluation framework with four security-specific metrics. To our knowledge, SecureCode is the first public dataset that jointly provides OWASP Top 10 2021 web coverage and OWASP LLM Top 10 2025 AI/ML coverage in a unified conversational schema suitable for instruction tuning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。